Posted
by
Soulskill
on Sunday July 17, 2011 @04:25AM
from the wrist-slap-doctrine dept.

JohnBert writes "The European Commission is examining whether additional rules are needed on personal data breach notification in the European Union. Telecoms operators and Internet service providers hold a huge amount of data about their customers, including names, addresses and bank account details. The current ePrivacy Directive requires them to keep this data secure and notify individuals if such sensitive information is lost or stolen. Data breaches must also be reported to the relevant national authority. 'The duty to notify data breaches is an important part of the new E.U. telecoms rules,' said Commissioner Neelie Kroes. 'But we need consistency across the E.U. so businesses don't have to deal with a complicated range of different national schemes. I want to provide a level playing field, with certainty for consumers and practical solutions for businesses.'"

(1) Notification of all data retention and breaches by government as a result of government legislation, since the EU demands all sorts of data retention for "law enforcement";

(2) Equivalent rules for everyone doing business in the EU even if they store data outside the EU;

(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).

(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).

(3) The requirement for governments to terminate contracts with any businesses involved in breaches more than n number of times (actually, I'd prefer no public-private partnerships on IT work whatever, but simply requiring competent contractors would go a great way toward this).

Just make it n=0 and I agree with you.

n=0 might just mean they are unable to notice breaches.

After all that happened lately to Sony they might learn from it and soon be the ones with the most secure network... Maybe not.

About 1), yes there is a requirement for data retention on connections, in other words the content or body of the message is not exposed.

When a EU authority including national authorities want access this is generally recorded and can later be questioned for legality.
Illegally obtained evidence is in most EU nations not admissible.
Where 'generally' and 'most' is written there is place for more EU rulings to level the playing field.

2), read TFA.
3), no, dissolve the business involved but first fine them

no, dissolve the business involved but first fine them into bankruptcy.

Bankruptcy should not be an excuse to avoid paying fines either. Andrew Crossley of ACS:Law escaped a Â£200,000+ fine for loss of extremely private by simply claiming to be insolvent. If you are a criminal ordered to pay reparations you don't get off simply by having no money, we wait until you do have money or just start selling off your stuff at auction.

Your paranoia is a little far-reaching here...sure a company is welcome to try that tactic but not without tarnishing their image. Try and repeat it enough times on a small scale or even once on a large enough scale there will be backlash as it will not be a smart choice to go with a compant who is constantly under-secured resulting in breaches and customer data loss. Just look at the whole Sony fiasco, er 17+ Sony fiascos rather...They were lucky to have a customer base on ps3 that are soo ADD they can't r

Your paranoia is a little far-reaching here...sure a company is welcome to try that tactic but not without tarnishing their image.

Your paranoia is a little short-reaching here... I'm talking about actions by government, not the corporations, although it's true that the two do regularly work together to fuck the populace out of their rights and money.

Wait a minute. I'm a manager, and I've been reading a lot of case studies and watching a lot of webcasts about The Cloud. Based on all of this glorious marketing literature, I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.

The case studies all use words like "secure", "MD5", "RSS feeds" and "encryption" to describe the security of The Cloud. I don't know about you, but that sounds damn secure to me! Some Clouds even use SSL and HTTP. That's rock solid in my book.

It is sarcasm but still believable. The gullibility of IT illiterate decision makers when schmoozed by weasels in an Armani suits is the stuff of legends. The scariest words you'll ever hear in IT are "that will take too long we'll buy a package". Run away screaming the second the words are uttered.

I, as a manager, have absolutely no reason to doubt the safety of any data put in The Cloud.

Do you work for a Cloud company? Those will be your famous last words. You seriously need to look at the bigger picture here. How funny will it be when your medical records end up as a bit-torrent? News of the World have been hammered and Murdoch to which I welcome.

Police corruption is rife and Cloud computing is spy-ware. Yes it will be hacked.

Now that The Cloud and US-based have been excluded at excuses to not report breaches of EU citizens data I wonder about the requirements and feasibility of reporting access by the notorious 3-letter agencies that seem to roam wild in the USofA...

I think it's worthy remembering two things:1) the European Commission (EUC) is not a decisional power. Its steatements are considered as mere advices by the Parliament, if considered at all.2) the same Parliament is not a Sovrane Government (think of the Federal Government). But still member's legislators have ten years (IIRC) to comply or face fines.

While you are right on point 2 (The EU is not sovereign), I disagree on point1.

The EU parliament has to vote on some, but not all, laws and is generally there to be seen as democratic rather than actually doing anything terrible important. The EU commission is somewhere between a 'civil service' where the highest ranking officials from each department discuss and decide what should be done (note that each country sends about 1 commissioner depending on their size, and commissioners also represent their home

The approach outlined here seems very reasonable to me. Personal data breach legislation was rushed into the reform package for telecommunications services in Europe, because it was better than waiting for the review of the data protection directive, where it properly sits. However, it means that regulation is vertical - affecting only telecoms service provision - rather than horizontal, which would affect all providers. Since directive 95/46/EC [europa.eu] - on data protection - is horizontal, it would make sense to insert the provisions into that directive, and remove them from directive 2002/58/EC [europa.eu] - the directive of privacy and electronic communications..

For those who care, the measures are contained within directive 2009/136/EC [europa.eu] (the relevant measures here are in Art. 2), but are amendments to Art. 4 of ePrivacy directive (above). However, as befits a directive forming part of the telecommunications package, the subject of the regulation are "provider[s] of a publicly available electronic communications service".

"a service normally provided for remuneration which consists wholly or mainly in the conveyance of signals on electronic communications networks, including telecommunications services and transmission services in networks used for broadcasting, but exclude services providing, or exercising editorial control over, content transmitted using electronic communications networks and services; it does not include information society services, as defined in Article 1 of Directive 98/34/EC, which do not consist wholly or mainly in the conveyance of signals on electronic communications networks"

I highlighted the reference to information society services, since this represents a substantial carve-out - this means that websites on online services which gather personal data, and which might suffer from data breaches, are not within the scope of the breach notification. When play.com suffered a breach, for example, it was not obliged under the breach notification to make any statement. It strikes me as odd - although understandable, given the context - that website operators, which are likely to generate huge swathes of personal data, should not be within scope. Something which a change from vertical regulation to horizontal regulation would hopefully remedy.

It's a bunch of circular gibberish designed as welfare for lawyers and bureaucrats who don't understand any of it either, but will make millions arguing about it in front of a guy who dresses funny, and might even wear one of those white wigs. I cannot for the life of me understand how we give these people any kind of credibility, much less actual authority.. Ultimately we will devolve into the age of bureaucracy when nothing else is left.